“Authentication” is the means by which a cellular network can validate the identity of a subscriber, or more accurately, of a Subscriber Identity Module (SIM) that is inserted into a mobile device. The Authentication Center (AuC) (which is typically part of or co-located with the Home Location Register (HLR) or Home Subscriber Server (HSS)) is configured to authenticate each SIM card that attempts to connect to the GSM core network. Once authentication is successful, the HLR is allowed to manage the SIM and subscriber services. The SIM and AuC have a shared secret that is unique to a given subscriber/SIM. The shared secret is used as an input to an authentication algorithm, either A3 or A8, that are executed at both the mobile device/SIM and the AuC. If the results from the mobile device and AuC match, authentication is deemed successful.
Successful authentication results in the establishment of a security association between the SIM and the network. This security association is basically a set of data, such as an integrity key and a ciphering key, which are used to provide security services during the life of that security association.
The IMS (IP Multimedia Subsystem) defines a generic architecture for offering multimedia services such as Voice over IP (VoIP). The IMS core network includes the Call Session Control Function (CSCF) and the Home Subscriber Server (HSS). The CSCF facilitates session setup and teardown using SIP (Session Initiation Protocol). The HSS plays the role of a location server in IMS and also serves as a repository for subscriber data. The CSCF is divided into three logical entities: Proxy CSCF (P-CSCF), Interrogating CSCF (I-CSCF), and Serving CSCF (S-CSCF). The P-CSCF is responsible for routing incoming SIP messages to the IMS registrar server and for facilitating policy control. The I-CSCF acts as an inbound SIP proxy server in the IMS. The S-CSCF is the heart of the IMS core network, and facilitates the routing path for mobile originated or terminated session requests and is the most processing intensive node of the IMS core network.
Before a user can have access to IMS services, an IMS-capable User Equipment (UE) equipped with a Universal Subscriber Identity Module (USIM) or an IP Multimedia Subscriber Identity Modules (ISIM) must authenticate with the S-CSCF. However, for older SIM-based UEs, access to IMS is not possible as the IMS specifications do not support the SIM-based A3/A8 authentication protocol, but rather define a newer security protocol called AKA or Authentication and Key Agreement.